Linux Ansible Deployment

Summary and Benefits

The HyperCollector Linux Ansible deployment is a playbook-driven deployment method to configure a Linux host to provide the best value cyber security data with the lowest deployment and maintenance impact. Key features of this approach are:

• Pre-configured rsyslog and auditd.
• Updated configurations and log settings by HyperSec via repository.
• Using native Linux components with no proprietary agent.
• Support for multi-Linux distributions and versions.
• Automated selective or mass deployment.
• SELinux and and other distro specific required security configuration.

https://docs.ansible.com/

Due to the use of Ansible the following deployment and management benefits are realised:

• Idempotence https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html .
• Rollback.
• Common deployment across the Linux fleet.
• Automated, agentless, open source based deployment.

Location

The deployment and all associated support files are located here:

https://gitlab.com/hypersec-repo/collector-integration/-/tree/main/collector-endpoint-linux?ref_type=heads

What is Deployed

The Ansible deployment installs and configures both the auditd and rsyslog daemon for standardised output to a collector over syslog/TCP.

Auditd is configured to write audit logs to the standard location (/var/log/audit) which is then picked up for transmission by Rsyslog.

Rsyslog is configured to transmit via syslog TCP with a modest local spool. This permits reliable transfer of log information without the risk of loss in case of minor system or communications interruption. A default UDP based deployment would incur data loss in these cases.

The default ports on a HyperCollector for the automation Linux deployment are:

• TCP/12201 for Linux Audit (auditd)
• TCP/12205 for local host general syslog

These streams will be automatically tagged for this form of traffic. If HyperSec XDR is used downstream for Cyber Threat Hunting, these streams will also receive further source-specific data quality improvements and enrichment.

Modification or Extension

The Ansible deployment is designed to be easily extensible for other sources such as web and database servers.

In this instance a copy or fork can be used used and the following changes made.

To both the 99-hs-rsyslog.j2 and 99-hs-rsyslog-legacy.j2 files, add:

1. The new source file location or pattern (e.g. /var/log/httpd/access.log) .
2. A new port destination for a new tagged syslog port on the HyperCollector (see below).

The existing auditd configuration in the default template can be used as a copy-paste guide.

On the HyperCollector itself, a new syslog tagged port

While the default syslog ports on the HyperCollector can be used it is recommended a new syslog tagged port be created in the UI and each new source sent to those. For example one for Apache http logs (e.g. TCP/30001), and a different port for Postgresql (e.g. TCP/30002).

Deployment

A standard Ansible deployment pattern is used. An environment file located in /collector-endpoint-linux/environments is used to control the list or group of hosts to be deployed along with connectivity settings.

Existing examples are presented in this repository.